Cloud Build 기본 서비스 계정에는 동일한 Google Cloud 프로젝트의 저장소에 대한 읽기 및 쓰기 권한이 있습니다. 사용자 제공 서비스 계정을 사용하거나 프로젝트 간에 이미지를 가져오고 내보내는 경우 빌드를 실행하는 서비스 계정에 Artifact Registry 작성자 역할을 부여합니다.
기본적으로 Compute Engine, Cloud Run, Google Kubernetes Engine에는 동일한 프로젝트의 저장소에 대한 읽기 권한이 있습니다. Artifact Registry가 런타임 환경과 다른 프로젝트에 있는 경우 런타임 서비스 계정에 Artifact Registry 리더 역할을 부여해야 합니다.
Cloud Build 기본 서비스 계정에는 동일한 Google Cloud 프로젝트의 저장소에 대한 읽기 및 쓰기 권한이 있습니다. 사용자 제공 서비스 계정을 사용하거나 프로젝트 간에 이미지를 가져오고 내보내는 경우 빌드를 실행하는 서비스 계정에 Artifact Registry 작성자 역할을 부여합니다.
기본적으로 Compute Engine, Cloud Run, Google Kubernetes Engine에는 동일한 프로젝트의 저장소에 대한 읽기 권한이 있습니다. 이러한 환경에서 타사 도구를 사용하여 이미지를 내보내는 경우 런타임 서비스 계정에 Artifact Registry 작성자 역할을 부여해야 합니다.
Artifact Registry에서 The repository has enabled tag immutability 메시지를 반환하면 저장소에 태그 불변성이 구성된 것입니다. 저장소에 있는 동일한 이미지의 다른 버전에 이미 사용된 태그가 있는 이미지를 푸시할 수 없습니다. 저장된 다른 이미지 버전에서 사용하지 않는 태그를 사용하여 이미지를 다시 푸시해 보세요.
저장소가 변경할 수 없는 이미지 태그에 대해 구성되었는지 확인하려면 Google Cloud 콘솔의 저장소 목록에서 변경할 수 없는 이미지 태그 열을 확인하거나 다음 명령어를 실행합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2024-12-21(UTC)"],[[["\u003cp\u003eThis page provides troubleshooting steps for managing container images in Artifact Registry, specifically addressing issues related to pulling and pushing images.\u003c/p\u003e\n"],["\u003cp\u003eWhen encountering problems pulling an image, ensure the image path is correct and that the pulling account has the necessary Artifact Registry Reader permissions.\u003c/p\u003e\n"],["\u003cp\u003eIf you are unable to push an image, confirm that the repository exists, the image path is correct, and the account has the appropriate Artifact Registry Writer permissions.\u003c/p\u003e\n"],["\u003cp\u003eTag immutability, when enabled, prevents pushing images with tags already in use by other versions of the same image, and checking the repository's configuration can help to fix this.\u003c/p\u003e\n"],["\u003cp\u003eIf you encounter \u003ccode\u003eImagePullBackOff\u003c/code\u003e or \u003ccode\u003eErrImagePull\u003c/code\u003e messages, you need to check the required permissions and then review the troubleshooting steps in the GKE documentation.\u003c/p\u003e\n"]]],[],null,["# Troubleshoot container image issues\n\nLearn about troubleshooting steps that you might find helpful if you run into\nproblems managing container images in Artifact Registry.\n\n### Cannot pull an image or deploy to a Google Cloud runtime environment\n\nCheck the following:\n\n1. Verify that the full path of the image that you are pushing is correct. The path must include the registry hostname, Google Cloud, project ID, repository, and image. For example: \n\n us-west1-docker.pkg.dev/my-project/my-repo/my-image:v1\n\n For more information, see [Repository and image names](/artifact-registry/docs/docker/names).\n2. Verify that the account that is pulling the image has the correct [permissions](/artifact-registry/docs/access-control) to read from the repository. If you have [disabled automatic role granting to service accounts](/resource-manager/docs/organization-policy/restricting-service-accounts#disable_service_account_default_grants), then you must grant Artifact Registry roles to the runtime service accounts.\n - For Compute Engine, Cloud Run, and Google Kubernetes Engine service accounts, you must grant the Artifact Registry Reader role (`roles/artifactregistry.reader`) to the runtime service account.\n - For your Cloud Build service account, you must grant the Artifact Registry Writer role (`roles/artifactregistry.writer`) to the service account that runs builds.\n - If you are using Docker or another third-party tool, you must:\n - [Grant permissions](/artifact-registry/docs/access-control#grant) to the account that interacts with the repository.\n - Configure the client to authenticate to the repository.\n - [Docker authentication](/artifact-registry/docs/docker/authentication) instructions\n - [Troubleshooting containerd node images on Google Kubernetes Engine](/artifact-registry/docs/integrate-gke#troubleshooting_containerd_node_images)\n\n### Cannot push an image to Artifact Registry\n\nTry the following:\n\n1. Verify that the repository exists. Unlike Container Registry, repository creation is a separate operation from pushing the first image. If the repository does not exist, then [create](/artifact-registry/docs/repositories/create-repos) it.\n2. Verify that the full path of the image that you are pushing is correct. The path must include the registry hostname, Google Cloud project ID, repository, and image. For example: \n\n us-west1-docker.pkg.dev/my-project/my-repo/my-image:v1\n \n Each Artifact Registry repository is a separate resource, so you cannot push\n an image to a path without a repository. For example,\n `us-west1-docker.pkg.dev/my-project/my-image:v1` is an\n invalid image path.\n\n For more information, see\n [Repository and image names](/artifact-registry/docs/docker/names).\n3. Verify that the account that is pushing the image has [permissions](/artifact-registry/docs/access-control) to write to the repository. If you have [disabled automatic role granting to service accounts](/resource-manager/docs/organization-policy/restricting-service-accounts#disable_service_account_default_grants), then you must grant Artifact Registry roles to the runtime service accounts.\n - For Compute Engine, Cloud Run, and Google Kubernetes Engine service accounts, you must grant the Artifact Registry Writer role (`roles/artifactregistry.writer`) to the runtime service account.\n - For your Cloud Build service account, you must grant the Artifact Registry Writer role (`roles/artifactregistry.writer`) to the service account that runs builds.\n4. If Artifact Registry returned the message `The repository has\n enabled tag immutability`, then tag immutability is configured for the repository. You cannot push an image with a tag that is already used for another version of the same image in the repository. Try to push the image again with a tag that is not used by other stored versions of the image.\n\n To verify that the a repository is configured for immutable image tags, check\n the **Immutable image tags** column in the list of repositories in\n Google Cloud console or run the following command: \n\n ```\n gcloud artifacts repositories describe REPOSITORY \\\n --project=PROJECT-ID \\\n --location=LOCATION\n \n ```\n\n### ImagePullBackOff and ErrImagePull messages\n\nMessages with `ImagePullBackOff` and `ErrImagePull` indicate that an image\ncannot be pulled from the registry by GKE.\n\n- Verify the [requirements](/artifact-registry/docs/integrate-gke#permissions) to pull from Artifact Registry.\n- Review [Troubleshoot image pulls](/kubernetes-engine/docs/troubleshooting/image-pulls) in the GKE documentation."]]
